CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

criticalknown exploitedpublic exploitCVE-2024-21887
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.

CSIRTS triage

vendor: Ivantiproduct: Connect Secure and Policy SecureCode injection
What
A command injection vulnerability allows an authenticated administrator to execute code on affected appliances.
Who is affected
Users of Ivanti Connect Secure and Policy Secure.
Urgency
Remediation is critical due to active exploitation and high severity.
Action
Update to the latest version as recommended by Ivanti.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Connect Secure and Policy Secure

Get an email when a new Connect Secure and Policy Secure advisory drops — max one per day, one-click unsubscribe.

Details

Source
CISA Known Exploited Vulnerabilities (US · database · site)
Severity
critical
Published
2024-01-10
Exploitation
Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-21887

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2024-21887coverage & exploitation statusNVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

More from CISA Known Exploited Vulnerabilities